Critical- Files deleted when viewed in file manager- modx 1.04

Thanks esche. No solution yet. Will definitely post it here if we find anything.

If anyone viewing this forum is on a HughesNet satellite connection, please let me know by posting a reply here. I have a theory to test...

Teri

I think we’re down to a pretty good hunch that it’s related to using the file manager over a satellite internet connection.

Sound crazy, but there are two pieces of evidence supporting that
1) multiple requests (view, delete etc) are being logged by Apache even though browser only issues one request
2) I can not replicate problem myself, though two years ago when I *was* using satellite internet, I experienced this problem. Also, highpointdesign and client have both experienced the problem using satellite internet, though client has also tested on a cable connection and *not* had the problem

I think what’s happening is that the satellite internet provider caches as much web content as possible on the satellite itself, to reduce latency, and to do so they do a lot of aggressive pre-fetching, essentially hitting and caching results of all links on requested pages. So essentially, the satellite robot, as it were, is hitting the delete buttons itself.

I have a plan to add a random token to the delete buttons in the file manager, and only let those tokens live through one request.

esche, thanks for the offer of help! If you or anyone else wants to take a stab at a fix for this before I get to it, by all means, that would be awesome. I just ask that you please fork the Evo repository from GitHub, work on the develop branch, then send a pull request when it’s ready. Please also update the bug report if you’re going to do some work on it. If any questions about all this, please let me know, I’m more than happy to help demystify the code contribution process if it seems daunting!

Actually, first, I think a ’nofollow’ on the links in the filemanager would be the best to try.. see if the satellite respects them.

Let me know when you have something you need to test- I’ll be your satellite guinea pig if you need one. I can leave my test site up indefinitely... For now I will tell my client to stay out of file manager if she’s working from home

Thanks again for the quick response and help.

Teri

I think we’re down to a pretty good hunch that it’s related to using the file manager over a satellite internet connection.

Wow. And a tip of the hat to you one that one - I’d have never come up with something like that.

I’ll be very interested to see if "nofollow" works.

Matt

Yes, it’s possible satellite internet pre-fetching & caching

I suggest, nofollow will have no effect.

I think it’s better to replace <a href="DIRECT_LINK" to smth:

<a href="javascript: delete_file(’filename’);"

or

<a href="#" onclick="return delete_file(’filename’)"

(deleting file with "post" form sending for non-javascript users doesn’t make sense, because without javascript backend doesn’t work =) )

in delete_file after confirmation we set


:) And it will reduce HTML length (current path is the same for all files and dirs)

ps netProphET, i’ve sent commit and pull request, which (I think) fix this. If it is bad code style or incorrect - you can edit or notify me.
pps. Anyone, who want to test this fix, could replace file manager/actions/files.dynamic.php with this. Be careful! Not recommended to test on production (few lines of code, all changes are "transparent" highlighted, but...) . And backup all important data!

Hey esche-

I think you’ve got it! I sent the new actions file up to my secondary test site and on first look this seems to have done the trick. I just had time for a quick test, but everything checked out. I could go into the folder without deleting files, I could view and edit and I could still delete files when I clicked delete. The log still says I am viewing a specific file when I haven’t clicked view- this is probably just a harmless quirk, but could you use the same method on the view button as you did on the delete button?

Good work! I should have time do more testing a bit later in the day.

Thanks!!!
Teri

Question for the modx code team, or anyone advanced enough to know the answer for sure-

For testing purposes, does manager/actions/files.dynamic.php deal with any functions other than the file manager? Is there anything else I should be testing or looking for?

Thanks-
Teri

@highpointdesign: manager/actions/files.dynamic.php is only used in the file manager. It’s possible (thought I’d say unlikely) that a third party snippet/plugin/module could include that file for some reason.. There’s certainly nothing in the core or in the core add-ons other than the file manager itself that uses that file.

@esche: Nice! Thanks for hopping on that.. going to review and integrate now, and this will make it into 1.0.5. Cheers!

@Tery, you’re welcome
@netProphET, It’s for fun and not so hard

Quote from: highpointdesign at Dec 23, 2010, 09:44 AM

The log still says I am viewing a specific file when I haven’t clicked view- this is probably just a harmless quirk, but could you use the same method on the view button as you did on the delete button?

@netProphET, if it chooses, you can add one more replacing. Or I can =)
ps. If you have any comments to my "code style" - please PM me.